CVE-2022-2809
Last modified
CVE-2022-2809 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. EPSS estimates a 0.59% chance of exploitation in the next 30 days.
Description
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openbmc-Project | Openbmc | >= 2.10.0, <= 2.13.0 |
References
- https://github.com/openbmc/bmcwebProduct, Third Party Advisory
- https://github.com/openbmc/bmcwebProduct, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-2809?
How severe is CVE-2022-2809?
How do I fix CVE-2022-2809?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-28079College Management System v1.0 was discovered to contain a S…8.8
- CVE-2022-2808Authorization Bypass Through User-Controlled Key vulnerabili…8.8
- CVE-2022-28080Royal Event Management System v1.0 was discovered to contain…8.8
- CVE-2022-28081A reflected cross-site scripting (XSS) vulnerability in the …6.1
- CVE-2022-28082Tenda AX12 v22.03.01.21_CN was discovered to contain a stack…9.8
- CVE-2022-28085A flaw was found in htmldoc commit 31f7804. A heap buffer ov…7.8
- CVE-2022-28090Jspxcms v10.2.0 allows attackers to execute a Server-Side Re…6.5
- CVE-2022-28093SCBS Online Sports Venue Reservation System v1.0 was discove…9.8
- CVE-2022-28094SCBS Online Sports Venue Reservation System v1.0 was discove…6.1
- CVE-2022-28096Skycaiji v2.4 was discovered to contain a remote code execut…7.2
- CVE-2022-28099Poultry Farm Management System v1.0 was discovered to contai…8.8
- CVE-2022-28101Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag…9
Are you affected by CVE-2022-2809?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST